This is pretty concerning...I'm not technical enough to understand it all but appreciate your hard work @crokkon

Really interesting.

Definitely seems like each app should have a unique key, or a common key + a unique ID.

Cheers,

@dcj

Let me explain.  If you supply your private posting key to @steemconnect in order to login to chainbb, or steemfiles, then you are using the v1 version of Steem Connect.   This way you do not have to trust steemfiles with your private posting key but instead you trust Steem Connect with the said key. With this key, Steem Connect creates and signs all of the transactions on behalf of Steemfiles or Chainbb.  These transactions should be from v1 versions of Steem Connect.

Now Steem Connect v2, you supply your active key even if the app wants to only post in your name.  I have noticed that various accounts are getting posting authority on my account due to my logging into services via Steem Connect 2.  In this case, the app can just post or vote and doesn't technically need to go through Steem Connect anymore.

D-tube gives you the option to login with your posting key or go through v2 Steem Connect and then login with your active key.  I find the former option a lot less risky.

@leprechaun

<p>Congratulations!  This post has been upvoted from the communal account, @minnowsupport, by crokkon from the Minnow Support Project. It's a witness project run by aggroed, ausbitbank, teamsteem, theprophet0, someguy123, neoxian, followbtcnews, and netuoso. The goal is to help Steemit grow by supporting Minnows.  Please find us at the <a href="https://discord.gg/HYj4yvw"> Peace, Abundance, and Liberty Network (PALnet) Discord Channel</a>.  It's a completely public and open space to all members of the Steemit community who voluntarily choose to be there.</p> <p>If you would like to delegate to the Minnow Support Project you can do so by clicking on the following links: <a href="https://v2.steemconnect.com/sign/delegateVestingShares?delegator=&amp;delegatee=minnowsupport&amp;vesting_shares=102530.639667%20VESTS">50SP</a>, <a href="https://v2.steemconnect.com/sign/delegateVestingShares?delegator=&amp;delegatee=minnowsupport&amp;vesting_shares=205303.639667%20VESTS">100SP</a>, <a href="https://v2.steemconnect.com/sign/delegateVestingShares?delegator=&amp;delegatee=minnowsupport&amp;vesting_shares=514303.639667%20VESTS">250SP</a>, <a href="https://v2.steemconnect.com/sign/delegateVestingShares?delegator=&amp;delegatee=minnowsupport&amp;vesting_shares=1025303.639667%20VESTS">500SP</a>, <a href="https://v2.steemconnect.com/sign/delegateVestingShares?delegator=&amp;delegatee=minnowsupport&amp;vesting_shares=2053030.639667%20VESTS">1000SP</a>, <a href="https://v2.steemconnect.com/sign/delegateVestingShares?delegator=&amp;delegatee=minnowsupport&amp;vesting_shares=10253030.639667%20VESTS">5000SP</a>. <br><strong>Be sure to leave at least 50SP undelegated on your account.</strong></p>

Thank you for the detailed post, even though the subject of the post is about steem connects use of the private key, it provided me with what I have been searching for. I have been looking for examples of steem-python and the detail in your posting, was an ahah moment!  Thank you.

One more reason to not give any authorizations to any apps in my name!

You can now use @steemconnect when sending money through blocktrades. It is convenience, so you don't have to copy/paste memo. No thanks, i would rather copy/paste myself. ;-)